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PREFACE 


On  June  9,  2000,  John  D.  Woodward,  Jr.,  a  RAND  Senior  Policy  Analyst, 
testified  before  a  hearing  of  the  Commission  on  Online  Child  Protection.  Congress 
created  the  Commission  in  October  1998  to  “identify  technological  or  other  methods  that 
will  help  reduce  access  by  minors  to  material  that  is  harmful  to  minors  on  the  Internet.” 
The  Commission  invited  Woodward  to  discuss  biometrics,  or  methods  of  automatically 
recognizing  a  person  using  distinguishing  physical  characteristics  and  personal  traits. 
Examples  of  biometrics  include  digitized  fingerprints,  retinal  and  iris  scans,  speaker 
recognition  and  hand  geometry. 

Addressing  the  Commission’s  interest  in  learning  if  biometrics  could  determine 
someone’s  age.  Woodward  testified  that  “This  Commission  understandably  wants  to 
protect  children  from  accessing  online  sites  that  are  harmful  to  minors.  As  part  of  its 
effort,  the  Commission  has  correctly  asked  whether  there  are  any  kinds  of  commercially- 
viable  age  verification  biometrics.  The  good  news  is  there  are  many  kinds  of 
commercially-viable  biometrics.  The  bad  news  is  there  are  no  age  verification 
biometrics,  no  age  determination  biometrics  and  no  age  estimation  biometrics.” 

Woodward,  an  attorney  and  former  operations  officer  for  the  Central  Intelligence 
Agency,  works  on  national  security  and  technology  policy  issues  at  RAND.  He  recently 
co-authored  RAND’s  study  on  U.S.  Army  biometric  applications.  Army  Biometric 


1 


Applications:  Identifying  and  Addressing  Sociocultural  Concerns,  RAND  Project 
Memorandum,  PM-1031-A,  (with  Katharine  W.  Webb  et  al.,  2000  Forthcoming). 


TESTIMONY 


Mr.  Chairman  and  Commission  Members,  thank  you  for  inviting  me  to  testify 
before  this  hearing  of  the  Commission  on  Online  Child  Protection.  I  am  honored  to 
appear  before  you  to  offer  my  insights  into  biometrics.1 

This  Commission  understandably  wants  to  protect  children  from  accessing  online 
sites  that  are  harmful  to  minors.  As  part  of  its  effort,  the  Commission  has  correctly  asked 
whether  there  are  any  kinds  of  commercially-viable  age  verification  biometrics.  The 
good  news  is  there  are  many  kinds  of  commercially-viable  biometrics.  The  bad  news  is 
there  are  no  age  verification  biometrics,  no  age  determination  biometrics  and  no  age 
estimation  biometrics. 

As  preparation  for  this  testimony,  I  spoke  with  Dr.  James  L.  Wayman,  the 
Director  of  the  National  Biometric  Test  Center  at  San  Jose  State  University.  According 
to  Dr.  Wayman,  no  currently  employed  biometric  technologies  have  any  capability  for 
age  estimation.  Wayman  concluded,  “It  seems  highly  unlikely  that  the  biometric 
identification  technologies  being  employed  today  will  ever  have  a  capability  for  accurate 

1  John  D.  Woodward,  Jr.  is  a  Senior  Policy  Analyst  at  RAND.  RAND  is  a  nonprofit  institution 
that  helps  improve  policy  and  decisionmaking  through  research  and  analysis.  This  testimony  is 
based  on  a  variety  of  sources,  including  research  conducted  at  RAND.  However,  the  opinions  and 
conclusions  expressed  are  those  of  the  author  and  should  not  be  interpreted  as  representing  those 
of  RAND  or  any  of  the  agencies  or  others  sponsoring  its  research. 
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age  determination.”  In  fact,  one  of  the  key  attributes  of  biometric  identification  systems 
is  that  very  little  or  no  personal  information  is  available  in  the  submitted  biometric 
sample.2 

I  recently  discussed  this  same  issue  with  Samir  Nanavati,  a  leading  biometric 
consultant.  Mr.  Nanavati  stated  that  there  are  “no  biometric  systems  that  are  capable  of 
accurately  determining  a  subject’s  age  or  age  category  ( e.g .,  under  18  years).”  It  is  true 
that  certain  age  groups  and  occupational  groups  have  a  more  difficult  time  participating 
in  some  biometric  systems.  For  example,  a  biometric  system  might  have  difficulty 
capturing  or  getting  a  fingerprint  biometric  from  an  elderly  bricklayer.  However,  it  does 
not  appear  that  any  commercially  available  biometric  system  or  any  system  currently  in 
development  is  able  to  use  this  degradation  in  performance  to  determine  a  person’s  age. 

Special  Agent  Edward  German  of  the  U.S.  Army’s  Criminal  Investigation 
Division  is  one  of  our  nation’s  leading  fingerprint  experts.  When  I  interviewed  him  as 
preparation  for  this  testimony,  Mr.  German  stated  that  to  his  knowledge,  “there  is  no 
reliable  age  determination  set  of  factors  based  on  the  human  body.  Currently,  there  is 
nothing  even  close  to  reliable  insofar  as  age  and  biometrics.  There  is  not  even  something 
that  gives  a  good  indication.” 


2  “Biometric  identification”  refers  to  the  use  of  physiological  characteristics  and  behavioral  traits 
for  the  automatic  identification  or  verification  of  individuals.  In  general,  biometric  identification 
requires  sensors  to  convert  a  physical  characteristic  or  behavior  of  a  person  into  a  signal  that  can 
be  stored,  or  compared  to  previously  stored  signals,  using  a  computer. 
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Even  estimating  age  in  a  face-to-face  context  can  be  difficult.  Common  sense  can 
help  a  cashier  tell  whether  a  person  trying  to  buy  alcohol  is  over  age  21.  But  for  many 
individuals  in  the  age  range  of  16  to  21  years,  personal  habits,  genetics,  and 
environmental  factors  combine  to  preclude  reliable  age  determination  from  physical 
attributes.  In  other  words,  nothing  magically  happens  physiologically  on  a  person’s 
twenty-first  birthday. 


While  the  search  for  age  determination  and  age  estimation  “metrics”  is  not  an 
Internet-only  phenomenon,3  the  Internet-driven  need  is  for  a  reliable,  remote  verification 
of  claimed  age  for  a  person  likely  to  be  unknown  to  the  checker.  As  Peter  T.  Higgins,  the 
former  head  of  the  FBI’s  Integrated  Automated  Fingerprint  Identification  System 
(IAFIS),  has  observed,  “There  might  be  some  who  advocate  using  a  driver’s  license  and 
comparing  the  person’s  face  to  the  license  photograph  remotely  through  a  camera  and 
facial  recognition  software.  The  security  concern,  however,  is  that  anyone  can  generate 
or  purchase  a  false  ID  with  a  photo.”4 


3  To  consider  just  one  example,  for  many  years,  law  enforcement  has  grappled  with  the  problem 
of  trying  to  determine  the  age  of  minors  appearing  in  pornographic  materials.  To  make  this  age 
determination,  investigators  used  a  list  of  features,  such  as  facial  and  pubic  hair,  breast 
development,  curvature  of  the  hips,  etc.  Called  “Tanner  staging,”  after  Dr.  James  Tanner  who 
compiled  the  list,  this  physical  feature  screening  for  age  determination  has  recently  been 
abandoned  at  Dr.  Tanner’s  urging  because  Tanner  scaling  is  not  designed  for  estimating 
chronologic  age  and,  therefore,  not  properly  used  for  this  purpose.  See,  e.g.,  Regional  Task  Force 
on  Internet  Crimes  Against  Children  for  Northern  New  England  available  at 
http://www.ci.keene.nh.us/police/tannerscale.html  (Tanner  staging  was  designed  for  estimating 
development  or  physiologic  age  for  medical,  educational,  and  sports  purposes,  in  other  words, 
identifying  early  and  late  maturers.  Tanner  staging  is  appropriate  for  this,  provided  chronologic 
age  is  known.). 

4  See,  e.g.,  Susan  Schmidt,  “Probe  Finds  Security  Lapses  at  Airport,  Pentagon,  FBI,”  Washington 
Post,  May  25,  2000,  at  A2  (“Startling  security  weaknesses  were  discovered  at  two  airports  and  all 
19  of  the  federal  agencies  visited  by  special  GAO  investigators,  who  used  counterfeit 
identification  and  phony  law  enforcement  badges  they  obtained  on  the  Internet.”). 
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It  is  possible  that  the  time  will  come  when  secured  databases  will  combine  both  a 
person’s  registered  biometric  and  a  verified  age  determination  procedure  to  achieve  the 
desired  protective  result.5  For  example,  this  age  determination  procedure  could  be  done 
during  enrollment  when  the  person  would  physically  appear  at  a  center  to  enroll.  But  this 
approach  does  not  depend  on  an  age  verification  biometric  but  rather  requires  a  vetted 
database  in  which  known  age  data  is  used  in  conjunction  with  a  biometric. 

Although  there  is  currently  no  reliable  age  determination  biometric,  there  is  one 
area  of  current  scientific  research  that  I  want  to  call  to  the  Commission’s  attention.  This 
research  involves  the  chemical  compositions  of  fingerprints  and  highlights  differences  in 
physical  characteristics  between  children  and  adults. 


In  layperson’s  terms,  when  a  finger  touches  a  surface,  it  may  leave  a  latent 
fingerprint  which  is  an  invisible  pattern  of  “oil,”  containing  chemical  secretions  from  the 
skin.  These  secretions  can  contain  hundreds  of  chemical  compounds.  Researchers,  led 
by  Dr.  Michelle  V.  Buchanan  of  the  Oak  Ridge  National  Laboratory,  have  concluded  that 
there  are  dramatic  differences  in  the  chemical  compositions  of  fingerprints  from  children 
and  adults.6  Dr.  Buchanan  believes  that  the  dramatic  differences  between  children  and 


5  For  example,  federal  law  requires  that  firearm  background  checks  generally  are  to  be  conducted 
using  a  computerized  system,  known  as  the  National  Instant  Criminal  Background  Check  System 
(NICS).  See  General  Accounting  Office,  Gun  Control:  Options  For  Improving  the  National 
Instant  Criminal  Background  Check  System,  GGD-00-56,  Apr.  12,  2000. 

6  Adult  fingerprints  contain  oilier,  longer-lasting  compounds,  such  as  fatty  acid  esters,  than 
children’s  fingerprints.  Children’s  fingerprints  contain  more  cholesterol  and  volatile  chemicals, 
such  as  free  fatty  acids,  than  adults’  fingerprints.  Many  of  the  chemical  components  released  by 
children’s  fingers  quickly  evaporate,  making  it  extremely  difficult  for  law  enforcement 
investigating  crimes  such  as  child  abduction.  See  “Chemicals  in  Fingerprints  Could  Help  Solve 
Crimes,”  Science  News,  Apr.  22,  2000;  Michelle  V.  Buchanan,  Keiji  Asano,  &  Arthur  Bohanon, 
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adult  fingerprints  can  be  explained  by  changes  brought  on  by  puberty.  She  believes  she 
can  determine  when  children  are  going  through  puberty  by  examining  the  chemical 
compounds  in  their  fingerprints.7  Research  in  this  area  continues.8 

In  conclusion,  while  an  age  verification  biometric  would  seem  to  be  the  ideal 
“silver  bullet”  to  protect  children  from  accessing  harmful  online  sites,  there  currently  is 
no  viable  age  verification  biometric.  While  I  am  reluctant  to  underestimate  the  speed  of 
technological  advance,  the  experts  seem  to  agree  that  an  age  verification  biometric  is  at 
best  a  very  long  way  from  reality. 

I  am  happy  to  answer  any  questions  you  may  have. 


“Chemical  Characterization  of  Fingerprints  from  Adults  and  Children,”  SPIE  Photonics  East 
Conference  Proceedings,  Conference  2941,  Nov.  1996,  at  89-95.  See  also  Deborah  Noble,  “The 
Disappearing  Fingerprints,”  Chem  Matters,  Feb.  1997,  at  9;  Deborah  Noble,  “Vanished  into  Thin 
Air:  the  Search  for  Children’s  Fingerprints,”  Analytical  Chemistry,  July  1, 1995,  at  435A. 

7  Analysis  of  the  chemical  composition  of  fingerprints  might  also  provide  (1)  medical 
information  ( e.g .,  explaining  why  some  people’s  skin  heals  more  quickly  than  others)  and  (2)  a 
noninvasive  way  to  test  for  certain  medical  disorders  or  presence  of  drugs  (e.g.,  nicotine).  The 
research  conducted  to  date  has  taught  law  enforcement  investigators  to  look  for  children’s 
fingerprints  as  soon  as  possible  because  they  can  quickly  evaporate  from  a  crime  scene. 

8  Dr.  Buchanan  and  her  colleagues  are  continuing  their  research  efforts.  Recently,  the  Forensic 
Services  Division  of  the  United  States  Secret  Service  has  also  begun  researching  this  area.  Dr. 
Buchanan’s  research  was  supported  by  the  Department  of  Energy’s  Chemical  and  Biological 
Nonproliferation  Program  (DOE  NN-20). 


